taodeng/olp
1
0
Fork 0
mirror of https://github.com/dtzp555-max/olp.git synced 2026-07-19 09:45:07 +00:00
Code Issues Packages Projects Releases Wiki Activity

chore(release): Phase 7 close — v0.7.0 (Solution 1 + opus 4.8) (#70)

Browse Source 
Closes Phase 7 with version bump from 0.5.1 to 0.7.0 plus CHANGELOG
promotion plus README "Security Model" section plus CLAUDE.md
release_kit overlay update.

Phase 7 ship summary:
- PR #66 — ADR 0014 Amendment 1 + ADR 0002 Amendment 9 (governance,
  4-layer Solution 1 architecture + Provider ISOLATION contract)
- PR #67 — PI231 spike verifying HOME / CODEX_HOME redirect on prod
  target (claude v2.1.152 + codex v0.133.0)
- PR #68 — Solution 1 implementation + opus 4.8 model registration
  (lib/sandbox/manager.mjs refactored; ISOLATION blocks on anthropic
  + codex; server.mjs wire-up; models-registry.json)
- PR #69 — Loader fix (lib/providers/index.mjs attaches ISOLATION
  named export onto provider default export) + test-context bypass
  for streaming singleflight cache test compatibility

Phase 7 verification (PI231 prod E2E with claude v2.1.154 +
codex v0.133.0 + OLP_SANDBOX_DISABLED=1):
- Real ~/.claude.json mtime unchanged across requests
- Real ~/.codex/auth.json mtime unchanged
- find ~/.claude.json ~/.claude ~/.codex -newer marker returns EMPTY
- claude-sonnet-4-6, claude-opus-4-8, gpt-5.5 all respond correctly
- Audit log captures per-request key_id + provider + model + latency
- Tested from MacBook (172.16.2.29) and PI230 (172.16.2.230) clients

Pre-Phase-7-close upgrades:
- PI231 claude CLI: 2.1.152 to 2.1.154
- Mac mini OpenClaw: 2026.5.22 to 2026.5.27 (via openclaw update)
- PI230 Hermes: 0.14.0 to 0.15.1 (pip + systemctl restart)

File changes:
- package.json: 0.5.1 to 0.7.0
- CHANGELOG.md: Unreleased promoted to v0.7.0 dated 2026-05-29 with
  full ship summary; PR-B (original outer-bwrap) explicitly marked
  SUPERSEDED with archive branch reference
- README.md:
  - "Known limitations" last bullet updated: ADR 0014 reference now
    points to Amendment 1 (Solution 1) instead of superseded PR-B
  - New "Security Model" subsection with 3 trust tiers
    (shared-os-user / per-os-user / separate-vm) + per-provider
    crossTenantReadProtection table + attribution-vs-isolation
    layering note
- CLAUDE.md release_kit overlay:
  - current_phase: "Phase 6" to "Phase 7 closed at v0.7.0
    (2026-05-29); Phase 8 not yet scoped"
  - current_pre_release_identifier: 0.6.0-phase6 to 0.7.0

Test status: 813/813 pass; Suite 44 (PI231 Layer 3 E2E placeholder)
documented as deferred (load-bearing isolation negative test now
delivered by the PI231 prod E2E in the Phase 7 verification above).

Tag: v0.7.0 pushed post-merge to trigger
.github/workflows/release.yml per release_kit overlay.

Co-authored-by: dtzp555 <dtzp555@gmail.com>
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
This commit is contained in:
dtzp555-max
2026-05-29 11:24:42 +10:00
committed by GitHub
co-authored by taodeng Claude Opus 4.7
parent 43ca4a65b0
commit 74e67fdca3
4 changed files with 71 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+23 -1
View File
@@ -580,7 +580,29 @@ Behaviors that work correctly at personal/family scale but have ratified follow-
- **Cline / Continue.dev / Cursor / Aider** — IDE clients typically run shell / fs tools locally on the user's machine, so self-checks report the user's machine correctly. No OLP-side action needed.
- **Generic agentic clients** — if your client routes tool execution to the OLP server, expect bot self-reports to describe the OLP server's state. Either: (1) configure your client's tool handler to run tools locally, or (2) document this to your client users as a known limitation.
See [ADR 0014](./docs/adr/0014-sandbox-runtime-integration.md) for the multi-tenant security counterpart of this issue — even with shell-tool routing, OLP server-side sandboxing prevents one client from reading another client's OAuth tokens (Phase 7 PR-A shipped; PR-B HTTP-path activation pending).
See [ADR 0014 Amendment 1](./docs/adr/0014-sandbox-runtime-integration.md) for the multi-tenant security counterpart of this issue. Phase 7 Solution 1 (shipped v0.7.0) per-spawn ephemeral `$HOME` + symlinked credentials redirect all CLI state writes to `/tmp/olp-spawn/<keyId>/<reqId>/home/`, so a prompt-injected `cat ~/.claude.json` reads only the ephemeral file, not other tenants' OAuth tokens.
### Security Model
OLP's multi-tenant isolation has **three deployment tiers**, each suited to a different trust model. The orchestrator reads each provider plugin's `ISOLATION` block (ADR 0002 Amendment 9) to pick the right primitives.
| Tier | Trust assumption | Mechanism | Suitable for |
|---|---|---|---|
| **shared-os-user** (default) | All OLP key holders trust each other (family / personal pool) | Per-spawn ephemeral `$HOME` (Layer 1) + symlinked credentials (Layer 2) + provider tool-suppression (Layer 4 — anthropic Phase 6c `--system-prompt`, codex `--sandbox read-only`) | Family LAN, personal multi-device, trusted small teams. ADR 0001 § Mission. |
| **per-os-user** | Trust boundaries between OLP keys (e.g., distinct family members on a shared host) | All of the above + per-OLP-key OS user (systemd `User=olp-<keyId>`, separate uid for kernel-level fs deny) | Untrusted-key deploy that still pools OAuth subscription. Operator-managed. |
| **separate-vm** | Adversarial isolation between OLP keys (commercial / public-demo scenarios) | All of the above + dedicated VM per OLP key | OLP outside its stated mission. Each provider plugin's `recommendedDeploymentTier` declares its minimum acceptable tier. |
The provider plugins' `crossTenantReadProtection` field declares **how** each protects against cross-tenant lateral filesystem reads:
| Provider | `crossTenantReadProtection` | Mechanism |
|---|---|---|
| anthropic (claude CLI) | `tool-suppression` | Phase 6c `--system-prompt` replaces claude's default system prompt; the model receives no tool descriptions for Read/Bash/etc., so prompt-injection produces no `tool_use` to read other tenants' files. |
| codex (codex CLI) | `inner-sandbox` | codex's own bubblewrap-based `--sandbox read-only` default confines shell-tool reads to its inner sandbox view. |
| mistral (vibe CLI) | `none` | No tool-suppression flag known on vibe at present. Recommended deployment tier `separate-vm` until a hardening regime is verified (Task #4 follow-up spike). |
**OLP_SANDBOX_DISABLED=1** env var disables Layer 3 (per-call sandbox-runtime wrapping) while preserving Layers 1+2+4. This is the post-Amendment 1 escape hatch retained for 1-2 releases; production deployments should leave it unset.
**Attribution vs isolation.** ADR 0007 multi-key auth provides **attribution** (per-key audit, per-key cache namespace, per-key provider gating). ADR 0014 Amendment 1 provides **isolation** (the security tier above). Both layer cleanly — attribution always operates; isolation tier is operator-selected per deployment.
---